1.The Design and Implementation of Valgrind
A number of academic publications nicely describe many aspects
of Valgrind's design and implementation. Online copies of all of
them, and others, are available on the Valgrind
publications page.
The following paper gives a good overview of Valgrind, and explains
how it differs from other dynamic binary instrumentation frameworks such as
Pin and DynamoRIO.
Valgrind: A Framework for Heavyweight Dynamic Binary
Instrumentation. Nicholas Nethercote and Julian Seward. Proceedings
of ACM SIGPLAN 2007 Conference on Programming Language Design and
Implementation (PLDI 2007), San Diego, California, USA, June
2007.
The following two papers together give a comprehensive description of
how most of Memcheck works. The first paper describes in detail how
Memcheck's undefined value error detection (a.k.a. V bits) works. The
second paper describes in detail how Memcheck's shadow memory is
implemented, and compares it to other alternative approaches.
-
Using Valgrind to detect undefined value errors with
bit-precision. Julian Seward and Nicholas Nethercote. Proceedings
of the USENIX'05 Annual Technical Conference, Anaheim, California,
USA, April 2005.
How to Shadow Every Byte of Memory Used by a Program.
Nicholas Nethercote and Julian Seward. Proceedings of the Third
International ACM SIGPLAN/SIGOPS Conference on Virtual Execution
Environments (VEE 2007), San Diego, California, USA, June
2007.
The following paper describes Callgrind.
A Tool Suite for Simulation Based Analysis of Memory Access
Behavior. Josef Weidendorfer, Markus Kowarschik and Carsten
Trinitis. Proceedings of the 4th International Conference on
Computational Science (ICCS 2004), Krakow, Poland, June 2004.
The following dissertation describes Valgrind in some detail
(many of these details are now out-of-date) as well as Cachegrind,
Annelid and Redux. It also covers some underlying theory about
dynamic binary analysis in general and what all these tools have in
common.